The vulnerability arises because ERB's deserialization guard was installed separately for result and run methods but omitted from public methods that also evaluate source code such as def_method, def_module and def_class. An attacker who can supply untrusted data to Marshal.load can instantiate an ERB object and then invoke def_module (or the other two methods) to execute arbitrary Ruby code. The missing guard permits the eval of the ERB source without checking the initialization flag, leading to remote code execution. This falls under CWE-502 (Deserialization of Untrusted Data) and CWE-693 (Improper Handling of Security-relevant Manipulation).

Systems that use Ruby 2.7.0 with ERB versions older than 4.0.3.1, 4.0.4.1, 6.0.1.1 or 6.0.4 are affected. The vulnerability is present in any environment where the erb gem is loaded and an attacker can trigger Marshal.load on untrusted input. The patch is available in ERB 4.0.3.1 and later, including 4.0.4.1, 6.0.1.1, 6.0.4, so any Ruby application that depends on an older erb gem carries this risk.

With a CVSS score of 8.1 the vulnerability poses a high severity. The EPSS score is under 1%, indicating low current exploitation probability, and the issue is not listed in CISA KEV. The attack requires the ability to deserialize arbitrary ERB objects. If an attacker can deliver untrusted Marshal data, they can immediately obtain code execution through def_module, def_method or def_class. Due to the need for deserialization access, the likelihood in production environments is limited but not negligible. Therefore, any exposed surfaces that accept serialized data must be scrutinized, and upgrading to a patched gem is the recommended mitigation.